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DETAILED ACTION 

1. Claims 1, 4, 5, 7 - 9, 11, 14, 15 and 17 - 22 are pending. 

Response to Arguments 

2. Applicant's arguments with respect to claim 1 have been considered but are moot 
in view of the new ground(s) of rejection, as necessitated by amendment by applicant 
on 03/09/2010. 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically teachd or described as set forth 
in section 102 of this title, if the differences between the subject matter sought to be patented and the 
prior art are such that the subject matter as a whole would have been obvious at the time the invention 
was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

4. Claims 1 , 4, 7 - 9, 1 1 , 14 and 17 - 22 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Ramachandran et al. U.S. PG-Publication No. (2003/0084343) 
in view of Hay U.S. PG-Publication No. (2002/0120868) and Barnes et al. U.S. Patent 
No. (7,382,787). 

5. As per claim 1 , Ramachandran teaches a logical security system for processing 
login and password data received from a client device during a server session with the 
Internet server in order to authenticate a logged in user (Ramachandran, Paragraph 
0009, login a user session with password) but fails to teach a physical security system 
for processing Internet protocol (IP) address information of the client device at the 
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Internet server in order to authenticate the client device for the duration of the server 
session, and a memory system for storing, at the Internet server, a list of each logged in 
user and a reference IP address collected during a login procedure, wherein the logical 
security system is configured to access the list to authenticate the logged in user, and 
wherein the physical security system is configured to separately access the list in order 
to authenticate the client device, wherein the physical security system includes a proxy 
server module for comparing only an incomplete portion of an IP address obtained from 
a received message against only a like incomplete portion of the reference IP address 
for the logged in user. However, in an analogous art Hay teaches a physical security 
system for processing Internet protocol (IP) address information of the client device at 
the Internet server in order to authenticate the client device for the duration of the server 
session (Hay, Paragraph 0012, IP Address to authenticate a user) and a memory 
system for storing, at the Internet server, a list of each logged in user and a reference IP 
address collected during a login procedure, wherein the logical security system is 
configured to access the list to authenticate the logged in user, and wherein the physical 
security system is configured to separately access the list in order to authenticate the 
client device (Hay, Paragraph 0012, List of authorized IP Addresses). And Barnes 
teaches wherein the physical security system includes a proxy server module for 
comparing only a portion of an IP address obtained from a received message against 
only a like portion of the reference IP address for the logged in user (Barnes, Col. 32 
Lines 25-31, Matches some portion of the IP address). 
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At the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to use Hay's method for dynamic server provisioning with 
Ramachandran's one protocol wed access to usage data in a data structure of a usage 
based licensing server because it offers the advantage of ensuring that a user cannot 
maliciously alter data/server (Hay, Paragraph 0008). 

At the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to use Barnes' Packet routing and switching with 
Ramachandran's one protocol wed access to usage data in a data structure of a usage 
based licensing server because it offers the advantage of reducing the risk that Packets 
are dropped (Barnes, Col. 3 Lines 23 - 28). 

6. As per claim 4, Ramachandran as modified teaches the physical security system 
terminates the session for the user if the portion of the IP address obtained from the 
received message does not match the like portion of the reference IP address for the 
logged in user (Hay, Paragraph 0012, log error if IP is not authorized). 

7. As per claim 7, Ramachandran teaches storing in a memory system, at the 
Internet server associated login data whenever a new server session is initiated on the 
Internet server from a client device (Ramachandran, Paragraph 0009, login a user 
session with password) but fails to teach a reference IP address and receiving a 
message from a requesting user at the Internet server; obtaining login data 
accompanying the message; obtaining an IP address from a message header in the 
message, determining if the login data of the requesting user is currently listed in the 
memory system as an existing session with the Internet server and if the login data of 
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the requesting user is currently listed, determining at the Internet server if the IP 
address from the received message matches the reference IP address associated with 
the login data of the requesting user, the determining of the IP address including 
examining only an incomplete portion of the IP address of the requesting user and 
determining if the portion matches only a like incomplete portion of the reference IP 
address. However, in an analogous art Hay teaches a reference IP address and 
receiving a message from a requesting user at the Internet server, obtaining login data 
accompanying the message; obtaining an IP address from a message header in the 
message (Hay, Paragraph 0012, IP Address to authenticate a user) and determining if 
the login data of the requesting user is currently listed in the memory system as an 
existing session with the Internet server (Hay, Paragraph 0012, List of authorized IP 
Addresses) and if the login data of the requesting user is currently listed, determining at 
the Internet server if the IP address from the received message matches the reference 
IP address associated with the login data of the requesting user (Hay, Paragraph 0012, 
List of authorized IP Addresses). And Barnes teacches the determining of the IP 
address including examining only an incomplete portion of the IP address of the 
requesting user and determining if the incomplete portion matches only a like portion of 
the reference IP address (Barnes, Col. 32 Lines 25 - 31 , Matches some portion of the 
IP address). 

At the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to use Hay's method for dynamic server provisioning with 
Ramachandran's one protocol wed access to usage data in a data structure of a usage 
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based licensing server because it offers the advantage of ensuring that a user cannot 
maliciously alter data/server (Hay, Paragraph 0008). 

At the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to use Barnes' Packet routing and switching with 
Ramachandran's one protocol wed access to usage data in a data structure of a usage 
based licensing server because it offers the advantage of reducing the risk that Packets 
are dropped (Barnes, Col. 3 Lines 23 - 28). 

8. As per claim 9, Ramachandran teaches the further step of terminating all server 
sessions listed in the memory system having the login data of the requesting user if the 
portion of the IP address from the obtained message does not match the like portion of 
the reference IP address (Hay, Paragraph 0012, log error if IP is not authorized). 

9. As per claim 1 1 , Ramachandran teaches a [[means]] a component for processing 
logical security information received from a client device during a server session in 
order to authenticate a logged in user (Ramachandran, Paragraph 0009, login a user 
session with password) but fails to teach [[means]] a component for processing Internet 
protocol (IP) address information of the client device in order to authenticate the client 
device during the server session by comparing the IP address of a received message 
against the list of IP addresses stored by the server; and [[means]] a component for 
storing, at the Internet server, a list of each logged in user and a respective reference IP 
address collected during a login procedure, wherein the component for processing 
logical security information is configured to access the list to authenticate the logged in 
user, and wherein the component for processing IP address information is configured to 
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separately access the list to authenticate the client device, wherein the component for 
processing IP address information includes a proxy server module for comparing only 
an incomplete portion of an IP address obtained from a received message against only 
a like incomplete portion of the reference IP address for the. However, in an analogous 
art Hay teaches [[means]] a component for processing Internet protocol (IP) address 
information of the client device in order to authenticate the client device during the 
server session by comparing the IP address of a received message against the list of IP 
addresses stored by the server (Hay, Paragraph 0012, List of authorized IP Addresses) 
and 

[[means]] a component for storing, at the Internet server, a list of each logged in user 
and a respective reference IP address collected during a login procedure, wherein the 
component for processing logical security information is configured to access the list to 
authenticate the logged in user (Hay, Paragraph 0012, List of authorized IP Addresses). 
And Barnes teaches wherein the component for processing IP address information is 
configured to separately access the list to authenticate the client device, wherein the 
component for processing IP address information includes a proxy server module for 
comparing only an incomplete portion of an IP address obtained from a received 
message against only a like incomplete portion of the reference IP address for the 
logged in user (Barnes, Col. 32 Lines 25 - 31 , Matches some portion of the IP address). 

At the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to use Hay's method for dynamic server provisioning with 
Ramachandran's one protocol wed access to usage data in a data structure of a usage 
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based licensing server because it offers the advantage of ensuring that a user cannot 
maliciously alter data/server (Hay, Paragraph 0008). 

At the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to use Barnes' Packet routing and switching with 
Ramachandran's one protocol wed access to usage data in a data structure of a usage 
based licensing server because it offers the advantage of reducing the risk that Packets 
are dropped (Barnes, Col. 3 Lines 23 - 28). 

10. As per claim 14, Ramachandran as modified teaches the [[means]] component 
for processing IP address information terminates the session for the user if the portion 
of the IP address obtained from the received message does not match the like portion 
of the reference IP address for the logged in user stored in the list (Hay, Paragraph 
0012, log error if IP is not authorized). 

11. As per claim 1 7, Ramachandran as modified teaches the portion of the IP 
address includes the first characters of the IP address (Hay, Paragraph 0012, 
comparing to see if the IP address is an authorized IP address, portion is interpreted to 
be the entire address). 

12. As per claim 18, Ramachandran as modified teaches the portion of the IP 
address includes the first characters of the IP address (Hay, Paragraph 0012, 
comparing to see if the IP address is an authorized IP address, portion is interpreted to 
be the entire address). 

13. As per claim 19, Ramachandran as modified teaches, wherein the portion of the 
IP address includes the first characters of the IP address (Hay, Paragraph 0012, 
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comparing to see if the IP address is an authorized IP address, portion is interpreted to 
be the entire address). 

14. As per claim 20, Ramachandran as modified teaches the IP address information 
is received from a proxy server capable of sending a plurality of IP addresses assigned 
to a plurality of client devices, and wherein the IP address includes a portion which is 
constant for each of the plurality of IP addresses (Hay, Paragraph 0012, IP Address to 
authenticate a user). 

15. As per claim 21 , Ramachandran as modified teaches the IP address information 
is received from a proxy server capable of sending a plurality of IP addresses assigned 
to a plurality of client devices, and wherein the IP address includes a portion which is 
constant for each of the plurality of IP addresses (Hay, Paragraph 0012, IP Address to 
authenticate a user). 

16. As per claim 22, Ramachandran as modified teaches the IP address information 
is received from a proxy server capable of sending a plurality of IP addresses assigned 
to a plurality of client devices, and wherein the IP address includes a portion which is 
constant for each of the plurality of IP addresses (Hay, Paragraph 0012, IP Address to 
authenticate a user). 

17. Claim 5 and 15 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Ramachandran et al. U.S. PG-Publication No. (2003/0084343) in view of Hay U.S. PG- 
Publication No. (2002/0120868) and U.S. Patent No. (7,382,787) and in further view of 
Muratov et al. U.S PG-Publication No. (2003/0097596). 
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18. As per claims 5 and 1 5, Ramachandran as modified teaches comparing IP 
addresses thru comparing authentication information transmitted and checking to see if 
the information including IP addresses match (Hay, Paragraph 0012, comparing to see 
if the IP address is an authorized IP address, portion is interpreted to be the entire 
address), but fails to teach deleting all instances of the logged in user. However, in an 
analogous art Muratov teaches deleting all instances of the logged in user (Muratov, 
Paragraph 0015). 

At the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to use Muratov's system for protecting data with 
Ramachandran's one protocol wed access to usage data in a data structure of a usage 
based licensing server because it offers the advantage of protecting data from 
unauthorized access (Muratov, Paragraph 0017). 



Conclusion 

Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See M PEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
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mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Roderick Tolentino whose telephone number is (571) 
272-2661 . The examiner can normally be reached on Monday - Friday 9am to 5pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Edan Orgad can be reached on (571 ) 272-381 1 . The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

Roderick Tolentino 

Examiner 

Art Unit 2439 



Application/Control Number: 10/667,852 
Art Unit: 2439 



Page 12 



Roderick Tolentino 
/R. 1.1 

Examiner, Art Unit 2439 



/Edan Orgad/ 

Supervisory Patent Examiner, Art Unit 2439 



